Endpoint
Authentication and target
Use an ACCOUNT credential for its bound account, or a USER credential with bothX-ISPB and X-Account-Number. If an ACCOUNT credential sends those headers, both must be present and must match its bound account. PLATFORM credentials are not accepted. All requests require the standard HMAC-SHA256 headers.
The curl example below uses an ACCOUNT credential bound to the operated account, so it omits X-ISPB and X-Account-Number. If X-Client-ID identifies a USER credential, add both target headers and include their exact trimmed values in the canonical header set before calculating X-Signature.
Request body
Success data
merchant_order_id, txn_id, and numeric txn_status. The current mapper does not populate declared payer and payee fields.
Behavior and validation
For a fixed-amount QR, the request amount must equal the cached amount. A QR without an embedded amount can receive one at confirmation. The reference is removed on success; a tested upstream payload failure retains it. No endpoint-specific idempotency key exists.Errors
Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:4000for missing required fields.4002for an invalid amount or merchant order format.400for a stale merchant order date.4003012for a missing, expired, or invalid reference.4004003when the reference belongs to another account.4003014for payment failure, plus mapped provider errors such as insufficient funds.400when a fixed QR amount is changed.